CVE-2022-51010CWE-20

CVE-2022-51010

Medium · published September 7, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
42.5
In the wild
Unconfirmed
What it is

PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received from clients in itemstack NBT data. Attackers can send crafted item IDs outside the valid range to trigger an uncaught exception that crashes the server.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00508 · 42.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-09-07T17:17Z
References (3)
https://github.com/pmmp/PocketMine-MP/commit/5fd685e07d61ef670584ed11a52fd5f4b99a81a7 · [email protected]https://github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fqx3-r75h-vc89 · [email protected]https://www.vulncheck.com/advisories/pocketmine-mp-before-4.4.2-server-crash-via-item-id · [email protected]
EPSS history
Timeline
  • 09 SEP 03:12Z
    EPSS moved — → 1%
    epss
  • 07 SEP 12:55Z
    PocketMine-MP before 4.4.2 Server Crash via Item ID
    cvelistv5